fix: two-phase Codex startup + clean orphaned TOML subsections

- Split Codex first turn into fast bootstrap (~5-9s) + task reply.
  Previously the entire task ran as turn 1, blocking message forwarding
  for minutes. Now: bootstrap gets threadId in ~9s, real task pushed as
  reply turn, orchestrator can forward messages between turns.

- Fix TOML section removal to also clean nested subsections like
  [mcp_servers.multiagents.tools.check_messages]. Orphaned tool
  approval configs with no parent server cause 'invalid transport' error.